Next Gen SWG

Hi Friends, I want to share this case study with the Netskope Community about the Azure Infrastructure integration and Netskope NewEdge. I have attached the complete documentation, and here below is a brief about the challenges and how to resolve them. ==========About this Case Study: One common scenario on Azure is finding organisations using Azure Firewall that wants to connect to Netskope NewEdge without disrupting or changing the current architecture too much. Another common scenario is that companies are obligated to use Azure Firewall for compliance purposes or because it is part of the service provided under management for their providers. This Case Study aims to provide the essential information to deploy and troubleshoot the Cloud Security Connector for Azure when connecting Servers and Virtual Desktops to NewEdge and using Azure Firewall. 

Hi everyone, happy Friday/weekend! I just have a couple of things that I wanted to ask and get answers. I've searched the documentation and have found no information regarding my question, though I might have used incorrect keywords1. If I am steering all web traffic to Netskope, what happens to web traffic that did not hit any policy ? Does Netskope have implicit deny?2. If I have Realtime Threat Protection policy below,Source: AnyDestination: Any Categorized web traffic Activities and Constraints: Upload and DownloadProfile and Action: Default Malware scan where all severities are just alerting with no Remediation Profilewhat happens when a categorized site did not hit any severity? will it load the site or not?I know these are basic questions and I appreciate you all for taking time in providing answers.Thanks and have a great weekend! 

Hi team can i able to give access to specific users who can have disable option. And have r

Microsoft’s Azure Active Directory is widely used by thousands of organizations around the globe.  It is the largest directory and identity provider in the world with this trend only accelerating as more and more organizations migrate away from on-premises Active Directory.    Those tens of thousands of organizational directories present an interesting security challenge to ensure users only access authorized tenants and resources.  Microsoft has long provided Tenant Restrictions as a means to restrict logins to authorized tenants.         In April of 2022, Microsoft announced a new, robust method of controlling access to Azure AD d

Hi everyone, thanks for reading. I'm trying to build some reports with Advanced Analytics.I wanted to created some widgets first and then reuse them to build several reports.I couldn't find a way to do that. I only can create widgets directly inside the report, which limits these widgets to be used in the report they were created from. If I create widgets outside a report I cannot find how to insert them in a report. NS docs say the following:WidgetsA widget is a good choice if you want to create, change, and test a report in one place but use it in multiple dashboards.The widget and the dashboard must be in the same folder. If the widget is changed, the changes to the widget will show in your dashboard. If the widget is deleted, the dashboar

Hi,We have some issues with a html that shows a circle loader. This html is categorised as malware by netskope: malware name: Trojan.HTML.MALINK.FASJSNORSmd5: 51618ac2b7cf5c4937213e965c00f20aSha256: 0b41f69e6564b9c89b1b344744c5b06eb4adc0e584028909286d2b936e1afed5This is the script content that loads the HTML:  <script language="Javascript">var _skz_pid = "9POBEX80W";</script> <script language="Javascript" src="http://cdn.jsinit.directfwd.com/sk-jspark_init.php"></script>  In virustotal, it is also categorised as malwareSearching in url scan, you can see

Hello All, I was wondering if there was a way to remove items from the alerts page for sites know I want to block but don't want to see in Skope IT alerts page?     An example would be items that are triggering based on "securepubads.g.doubleclick.net" as a malsite.  I know I want to block these but I don't want all of these entries filling up our Alerts log in Skope IT.  Is there a way to block this but not alert to Skope IT easily without having to pull it into a new policy with a custom URL list?   Thank you.

Dropbox is flexible cloud storage service increasingly exploited by attackers for opportunistic and targeted campaigns. In my latest Cloud Threats Memo, i described two recent campaigns, providing some strategies to mitigate the risk of legit cloud storage services exploited for malicious purposes.   https://www.netskope.com/blog/cloud-threats-memo-dropbox-flexible-cloud-storage-increasingly-exploited-by-attackers

What are the use cases of Netscope chrome extension? Is this designed just to address Chromebook support? Does this extension only steer browser-based traffic or other app-based web traffic as well running on any client machine? Can I push the extension through MDM or UEM?

Hi Team, I am seeing intermittent outlook disconnect through forward proxy. Has anyone seen this issue? What is the best practice for outlook-O365 traffic through Netskope forward proxy with SSL inspection?

Hello everyone, thanks for reading this. I'm trying to detect MIP labels with real-time SMTP outbound app policies, but I cannot make it work. I found this video (Microsoft and Netskope Email MIP) where it shows a bit how MIP label ID has been set as a regex and scan type is Metadata&Content.Unfortunatelly it does not show the rest of DLP Rule configuration. I tried the same config as the video, also tried the same but adding "^.+" and ".+$" before and after the regex respectively as well.I also tried putting the whole "MSIP_Label_{LABEL-ID}_Name" string, which can be seen opening the MIP labeled MS Office document and going to "File > Information > Properties > Advanced Properties > Custom Tab".I set scan type as Metadata&Content, set the threshold to 1 and se

Configuration Document for Netskope Tenant SSO with One Login

I am trying to understand how the forward proxy handles user authentication/identification when SSL is set to bypass when there is no agent running on the endpoint. 

Does Netskope have a list of web site URLs that have been defined for testing policies?

I am interested to know how other customers are able to present a block page when a user is browsing from a network segment that has an SSL Decrypt Bypass policy applied.  Currently, users are shown a generic "this site can't be reached" message versus our branded block page.  Netskope Support stated the branded block page (custom User Notification) cannot be displayed since Netskope is not intercepting the traffic due to the SSL Decrypt bypass policy.  Is anybody else experiencing the same issue?

when configuring a CASB  real time policy for the Google Gmail app, is it possible to configure email deletion activity? or how to achieve this

Hello folks, I'm having difficulties to use traffic steering on my Galaxy S8. Hopefully, I want to know what caused this and if it is what it is, way to configure my Galaxy S8/Android device to use VPN like iOS would be nice.   I've sent invitation to my email account on Security Cloud Platform -> Netskope Client -> Users. Then clicking Android Client link on the mail led me to Google Play Store link. Then Google Play Store Netskope Cloud Directory page appears and I tab install button. Then open. Then Netskope Client says "Client is waiting for configuration". Then nothing. No further progress. In Settings, Organization, Gateway, Gateway IP Address, Steering Configuration, Device Classification are blank.   My other Galaxy Note 10 appears to working fine.   both devices gets link like

In this example, we want to block Streaming and Downloadable Video, and need to: Remove that category from the default steering exceptions to ensure it is steered to the Netskope cloud. Identify which URLs you want to block and which you want to bypass. For mediacompanyabc.com most if not all the actual streaming content is hosted on mediacompanyabc.com/videos, so for our example we are going to create a custom category with an exclusion to accommodate our use case. using mediacompanyabc.com/videos as the exclusion to a custom News and Media category. Create a custom URL list and call it “Streaming and Downloadable Video UL” (UL is for URL List) and add mediacompany

Please reference the updated Inline Learning path sections for this content Below is the course order by depth of contentNG-SWG: Introduction and Concepts - Getting StartedBest Practice Policy Strategy - Adoption/Maturing PoliciesBest Practice Use Cases - Specific Use Case Review

Hello Community, I have deploy the MacOS agent via Intune, but at the client configuration, the user need to accept to add a Proxy configuration. (like file attached.) I know it's possible to bypass that for Jamf by following this configuration : https://docs.netskope.com/en/deploy-netskope-client-with-jamf.html Anyone of you is in the same situation ? do you have resolve it ?  Thanks for your feedbacks.

Hi all, wondered if anyone rolling out SWG has had any issues with getting Windows updates to install with SWG enabled in Asia.   I have the same Windows steering bypasses set up for EU users and Asia but for some reason India and HK  users are getting a fail to update on the windows update page unless i disable the netskope client.   My exceptions are below.  I've covered everything MS say i need except go.microsoft.com and its not needed for EU users and just directs to the micosoft buy our devices  page.  Any ideas ?      *.download.windowsupdate.com*.update.microsoft.com*.windowsupdate.com*.windowsupdate.microsoft.comdl.delivery.mp.microsoft.comdownload.microsoft.comntservicepack.microsoft.comr.manage.microsoft.comwindowsupdate.microsoft.comwustat.windows.com

Does anyone out there know if you can embed a link into the custom block page messages a user receives?

In our latest Cloud and Threat Report, we breakdown the most significant trends we saw in 2021: Google Drive emerges as the top app for malware downloads Emotet copycats continue to abuse Microsoft Office documents More than half of managed cloud app instances are targeted by credential attacks Rate at which users leave their jobs (and take data with them when they do) doubles   One of the major highlights was the while OneDrive was the top app for malware downloads in 2020, Google Drive took the top spot in 2021, with OneDrive coming in second place.      

Environment: Netskope client installed with client configuration "Allow disabling of Clients" disabled Requirement: Need to Disable/Enable Netskope client from admin console instantly.   Hi Folks,   We might have faced an event where we have to enabledisable Netskope client from the admin console, But it takes more than 2-3 minutes to get it reflected on the Client. Sometimes it takes more than 5 minutes to get it reflected on the end-user machine which really makes the troubleshooting duration extended.   Resolution:   1) EnableDisable Netskope client from Security Cloud Platform > Netskope Client > Devices 2) Add some dump changes on Client steering configuration (Security Cloud Platform > Traffic Steering > Steering Configuration)3) Revert the steering configuration changes back.

For some reason I felt that in a recently Netskope release I saw something about a referrer policy.   We have run into issues in our organization with some websites functioning properly as we silently block the "Online Ads" URL category. Often times, a URL may be classified as Online Ads, but may be necessary for the website to function. We have often just created a real-time protection policy to permit the URLs in a URL list and applied this to the appropriate users. I thought I saw something about using a referrer policy in a recent release that if you permitted the main page, any subsequent URLs that were loaded were also permitted. Almost like a parent-child relationship with processes. I may be dreaming, but I could not find anything in the recent release notes or documentation.   If this does not exist, does this functionality exist if Netskope does not have a defined Cloud App that would permit the associated URLs? Would the